Information Security Policy in the U.S. Retail Payments Industry

Abstract

The United States retail payments industry is in the middle of a transition in regard to information security. A substantial number of data breaches have occurred over the last five years, despite substantial compliance with the industry standard, the Payment Card Industry Data Security Standard. There will need to be a move to a higher level of security, and the major challenge is institutional. How can the industry organize itself to move collectively toward this goal? Without recommending any particular technical solution, this paper proposes one way to meet this institutional challenge. Drawing on the experience of Europe and the United Kingdom in moving to a chip and PIN environment, I recommend a public-private partnership where industry, government and civil society jointly work through the technical, economic and public policy issues that need to be solved if we are to have improved information security in the industry. I look at information security as a third-party indirect liability regime, assessing the system externalities and liability rules that create misaligned incentives for investments in information security. I review the Payment Card Industry Data Security Standard, including examples of its data security rules, levels of compliance and validation. I discuss some public policy issues including mandated cost recovery schemes, data notifications laws, specific security laws, action by the Federal Trade Commission to treat security lapses as unfair acts, and general security laws that require reasonable levels of security. I discuss end-to-end encryption and chip and PIN as possible upgrades to the current system. I conclude with a recommendation for public-private partnerships to move the system forward to higher levels of information security, involving government as an active convener of these public-private coordinating groups.